Sanitize html (#3708)

[lemmy.git] / crates / api_crud / src / private_message / update.rs

diff --git a/crates/api_crud/src/private_message/update.rs b/crates/api_crud/src/private_message/update.rs
index 5f23f1bcd4da3fc5879444e2be01a3dcae7fab2d..09b50540dba830f5f3c2a9bfb7217a3dbc1607af 100644 (file)
--- a/crates/api_crud/src/private_message/update.rs
+++ b/crates/api_crud/src/private_message/update.rs
@@ -1,61 +1,66 @@
 use crate::PerformCrud;
 use actix_web::web::Data;
 use lemmy_api_common::{
-  blocking,
-  get_local_user_view_from_jwt,
-  person::{EditPrivateMessage, PrivateMessageResponse},
+  context::LemmyContext,
+  private_message::{EditPrivateMessage, PrivateMessageResponse},
+  utils::{local_site_to_slur_regex, local_user_view_from_jwt, sanitize_html},
 };
-use lemmy_apub::protocol::activities::{
-  create_or_update::private_message::CreateOrUpdatePrivateMessage,
-  CreateOrUpdateType,
+use lemmy_db_schema::{
+  source::{
+    local_site::LocalSite,
+    private_message::{PrivateMessage, PrivateMessageUpdateForm},
+  },
+  traits::Crud,
+  utils::naive_now,
+};
+use lemmy_db_views::structs::PrivateMessageView;
+use lemmy_utils::{
+  error::{LemmyError, LemmyErrorExt, LemmyErrorType},
+  utils::{slurs::remove_slurs, validation::is_valid_body_field},
 };
-use lemmy_db_schema::{source::private_message::PrivateMessage, traits::Crud};
-use lemmy_utils::{utils::remove_slurs, ConnectionId, LemmyError};
-use lemmy_websocket::{send::send_pm_ws_message, LemmyContext, UserOperationCrud};
 
 #[async_trait::async_trait(?Send)]
 impl PerformCrud for EditPrivateMessage {
   type Response = PrivateMessageResponse;
 
-  #[tracing::instrument(skip(self, context, websocket_id))]
+  #[tracing::instrument(skip(self, context))]
   async fn perform(
     &self,
     context: &Data<LemmyContext>,
-    websocket_id: Option<ConnectionId>,
   ) -> Result<PrivateMessageResponse, LemmyError> {
     let data: &EditPrivateMessage = self;
-    let local_user_view =
-      get_local_user_view_from_jwt(&data.auth, context.pool(), context.secret()).await?;
+    let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
+    let local_site = LocalSite::read(&mut context.pool()).await?;
 
     // Checking permissions
     let private_message_id = data.private_message_id;
-    let orig_private_message = blocking(context.pool(), move |conn| {
-      PrivateMessage::read(conn, private_message_id)
-    })
-    .await??;
+    let orig_private_message =
+      PrivateMessage::read(&mut context.pool(), private_message_id).await?;
     if local_user_view.person.id != orig_private_message.creator_id {
-      return Err(LemmyError::from_message("no_private_message_edit_allowed"));
+      return Err(LemmyErrorType::EditPrivateMessageNotAllowed)?;
     }
 
     // Doing the update
-    let content_slurs_removed = remove_slurs(&data.content, &context.settings().slur_regex());
-    let private_message_id = data.private_message_id;
-    let updated_private_message = blocking(context.pool(), move |conn| {
-      PrivateMessage::update_content(conn, private_message_id, &content_slurs_removed)
-    })
-    .await?
-    .map_err(|e| LemmyError::from_error_message(e, "couldnt_update_private_message"))?;
+    let content = sanitize_html(&data.content);
+    let content = remove_slurs(&content, &local_site_to_slur_regex(&local_site));
+    is_valid_body_field(&Some(content.clone()), false)?;
 
-    // Send the apub update
-    CreateOrUpdatePrivateMessage::send(
-      updated_private_message.into(),
-      &local_user_view.person.into(),
-      CreateOrUpdateType::Update,
-      context,
+    let private_message_id = data.private_message_id;
+    PrivateMessage::update(
+      &mut context.pool(),
+      private_message_id,
+      &PrivateMessageUpdateForm::builder()
+        .content(Some(content))
+        .updated(Some(Some(naive_now())))
+        .build(),
     )
-    .await?;
+    .await
+    .with_lemmy_type(LemmyErrorType::CouldntUpdatePrivateMessage)?;
+
+    let view = PrivateMessageView::read(&mut context.pool(), private_message_id).await?;
 
-    let op = UserOperationCrud::EditPrivateMessage;
-    send_pm_ws_message(data.private_message_id, op, websocket_id, context).await
+    Ok(PrivateMessageResponse {
+      private_message_view: view,
+    })
   }
 }